WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory

WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory has 17 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 17 are fixed as of October 2026. Their average CVSS score is 5.8, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 6 high. 2026 was the busiest year with 10 disclosures.

The most common weakness is Missing Authorization, behind 7 of the records (41%). Other recurring categories include Improper Privilege Management, Path Traversal.

Every one of the 17 issues recorded for WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory has a vendor fix available, so running the current release closes all known holes.

15 independent researchers contributed these findings, most of them (2) reported by Ananda Dhakal. WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

01234567891006.07.2015Today06.09.20215.4User Registration < 2.0.2 - Authenticated Stored Cross-Site Scripting CVSS 5.4 · 06.09.202122.09.20217.5WP User Manager <= 2.6.2 - Arbitrary User Password Reset CVSS 7.5 · 22.09.202116.08.20244.3WP User Manager <= 2.9.10 - Cross-Site Request Forgery CVSS 4.3 · 16.08.202422.11.20244.3WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Authenticated (Subscriber+) User Meta Key Enumeration CVSS 4.3 · 22.11.20244.3WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Carbon Fields Custom Sidebar Addition/Removal CVSS 4.3 · 22.11.202419.05.20257.5User Manager <= 2.9.12 - Authenticated (Subscriber+) PHP Object Injection CVSS 7.5 · 19.05.202511.12.20256.8WP User Manager <= 2.9.12 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter CVSS 6.8 · 11.12.202505.06.20268.1WP User Manager – User Profile Builder & Membership <= 2.9.16 - Authenticated (Subscriber+) Arbitrary File Deletion CVSS 8.1 · 05.06.20267.5WP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter CVSS 7.5 · 05.06.202621.09.20264.3WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback CVSS 4.3 · 21.09.202622.09.20265.3WP User Manager – User Profile Builder & Membership <= 2.9.19 - Missing Authorization CVSS 5.3 · 22.09.202603.10.20267.3WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.20 - Unauthenticated Privilege Escalation CVSS 7.3 · 03.10.202612.10.20264.3WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.22 - Missing Authorization CVSS 4.3 · 12.10.202613.10.20265.3WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.23 - Missing Authorization CVSS 5.3 · 13.10.202615.10.20265.3User Manager 2.9 - 2.9.19 - Unauthenticated Payment Bypass CVSS 5.3 · 15.10.202619.10.20267.3User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation CVSS 7.3 · 19.10.202620.10.20264.3WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.25 - Missing Authorization CVSS 4.3 · 20.10.2026

Strategic Overview

Avg CVSSMedium
5.8/ 10
Patch Coverage100%
Open

0

Fixed

17

Get automatic notifications for all WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.1CVE-2026-49766

WP User Manager – User Profile Builder & Membership <= 2.9.16 - Authenticated (Subscriber+) Arbitrary File Deletion

Read the full analysis

Vulnerability Records

17 records
2026-10-20 15:14CVE-2026-112823
4.3
Medium
ssophizYes
2026-10-19 00:00CVE-2026-110523
7.3
High
Charles VosburghYes
2026-10-15 00:00CVE-2026-110527
5.3
Medium
Sanjorn KeeratirungsanYes
2026-10-13 00:00CVE-2026-108496
5.3
Medium
TruebirdYes
2026-10-12 08:25CVE-2026-107423
4.3
Medium
Atia AvelaYes
2026-10-03 17:37CVE-2026-103085
7.3
High
Pedro DelgadoYes
2026-09-22 00:00CVE-2026-94079
5.3
Medium
Ananda DhakalYes
2026-09-21 18:59CVE-2026-18345
4.3
Medium
Wordfence PRISMYes
2026-06-05 00:00CVE-2026-49766
8.1
High
endyYes
2026-06-05 00:00CVE-2026-9290
7.5
High
YatYes
Showing 1–10 of 17 reports
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory banner
Latestv2.10.1

WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory

WP User Manager

Author

WP User Manager

4.7(350)
94/100
Last Updated
2026-10-27 (1d ago)
Active Installs
10,000+
Downloads
773,019
Requires WP
4.9+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2015-07-06 (12y ago)

User registration, login, profiles and member directories for WordPress WP User Manager replaces the default WordPress login and registration with forms that live on your own pages and match your theme. Members get a public user profile and an account page to edit their details, and you can list them in a searchable member directory. Use it to build a membership site, a community, a client portal, or simply a better registration form and login page than WordPress gives you out of the box. What you can build with the free plugin: A custom registration form on any page, with your own user fields, terms and privacy checkboxes, and automatic login after signup A front-end login form and login page, with password recovery, so users never see wp-login.php User profile pages with custom avatars, cover images and tabs for each member’s posts and comments A member directory with search, sorting and filtering by role, displayed anywhere with a block or shortcode An account page where members update their details and change their password Paid registration with Stripe, collecting a one-off or recurring payment when someone signs up Content restriction by role or logged-in status, on whole pages or on any individual block, plus custom redirects after login, logout and registration Blocks and Elementor widgets for every form and page: login, registration, password recovery, account, profile, profile card, user directory, recently registered users, and login and logout links. Shortcodes work everywhere else Website | Addons | Documentation | Support Features included Frontend forms: Allow users to register and login from the front of the site. Customize the registration form with custom fields to collect data Stripe integration: Take one-off or recurring payments on the registration form, using Stripe Connect Custom email notifications: Customize the emails sent to users when the register, reset their password and more Custom avatars: Users can edit their site avatar by uploading an image from the account page Elegant user profiles: All users have a public profile page to display their data Shortcodes editor: Easily add the plugin shortcodes to pages or posts with the shortcode generator and editor Roles editor: Edit roles and their capabilities. Create new roles and duplicate existing ones Beautiful user directories: Display users in a directories that can be displayed anywhere on the site SEO URLs: All the URLs are SEO friendly Content restriction: Restrict content for certain users, by logged in status, or by role Passwords management: Allow users to update their password from their account page Custom fields editor: Create custom user fields that can be used to collect data on registration Custom widgets: Display user data and forms in sidebars using widgets Custom redirects: Control where the users are redirected to on login, registration and more Powerful tools: Tools to be in control of your site and who registers Developers friendly: Customize and integrate with other plugins with a large number of hooks and filters Extensive documentation: Full documentation and expert support Translation Ready – The plugin and addons are fully localized ready for translation Read more about our features on wpusermanager.com Premium Features For more advanced functionality check out the pricing page. Custom Fields: Add custom fields to members profiles and registration forms WooCommerce: Integration with WooCommerce. Collect payment at registration, allow members to update their billing and shipping addresses, display product purchases, reviews and more! Stripe Pro: Integration with Stripe. Collect payment at registration with Stripe, restrict access to your site, remove the commission fees. User Verification: Send a verification link via email upon registration or manually approve users before they can login Groups: Give your users the ability to create and join groups Security: Add password security features and user login management features Registration Forms: Create unlimited registration forms, create multi-step forms, customize forms with HTML, and have full control over form settings Frontend Posting: Allow your users to submit posts and other content from the frontend Advanced Custom Fields: Collect ACF user data at registration and allow users to see and edit the data on their profile Social Login & Registration: Allow your users to quickly login and register with their favorite social network account, Facebook, Twitter, Instagram & LinkedIn Private Content: Provide private content for all your users, as well as user specific content so you can tailor for each member Mailchimp: Sync users with Mailchimp upon registration & more Google reCAPTCHA: Stop spam registrations on your website for free Content Restriction Plus: One-click restriction to posts, pages and custom post types Likes: Allow your users to like posts, pages and other content hCaptcha: Stop more bots. Start protecting user privacy with hCaptcha WPML: Translate your custom fields, field groups, registration forms, and emails using WPML Personal Data: Allows the user to request an export of personal data and request erasure of personal data from the account page for GDPR compliance Delete Account: Allows the user to delete their own profile from the frontend account page Free Extensions Newsletter: Subscribe your members to your Newsletter plugin lists easily during registration Username Length: Set minimum and maximum characters length for usernames Translations Want to add a new language to WP User Manager? Awesome! You can contribute via translate.wordpress.org. Please read the official translation tutorial for more information. Support Support is provided only through the support forum. Join the support forum to ask questions and get help regarding WP User Manager. Free support is provided exclusively for bugs and help using the plugin. Please read the support policy https://wpusermanager.com/support-policy/. Before opening a support topic please read the faqs and documentation. Support for premium addons is provided exclusively through the premium support platform. Support for premium addons cannot be provided through WordPress.org due to the rules put in place by the WordPress.org team.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C